As organisations brace themselves for another year of heightened cyber security threats, a risk much closer to home may pose a greater challenge. Insiders – in the guise of disgruntled employees, "bad leavers" (those dismissed under gross misconduct and other negative or damaging circumstances) or contractors with short-term access to sensitive data and corporate systems – could turn out to be a company's achilles heel, proving more harmful than external threats.

The risks have been underscored by Carnegie Mellon University, which found that malicious insider activity goes undetected for, on average, 32 months (pdf). Incidents can be costly, time consuming and damaging to corporate reputations, and insider threats such as fraud, theft of intellectual property and sabotage must be tackled alongside those posed by external perpetrators.

One area that requires particular attention is the management of staff exits. Because the process is often regarded as an operational HR issue, the risk of losing digital information in the wake of bad leavers is frequently nothing more than an afterthought. However, services such as iCloud, Google Drive and Dropbox allow staff to easily move vast quantities of data off work devices.

At the same time, instant messaging apps, including iMessage and Snapchat, offer the means to communicate semi-covertly, even while using corporate computers. The reality of this highly connected workplace means employers must take steps to understand whether a departing member of staff represents a risk of data theft and if so, be prepared to investigate that possibility before key evidence is lost.

Establishing proof of the actions of a bad leaver or rogue employee can rapidly remove any doubt about their motivations, and claims of innocence or of a simple misunderstanding. We regularly find that an individual leaver or entire teams have been communicating with their new employer and each other, well ahead of the move. Such communications are typically accompanied by the theft of documents, trade secrets, contact and price lists, alongside the tools required to easily replicate and harm their employer's business. Even emails are becoming antiquated, with teams using online filesharing services to share documents, as well as social media to plan their movements and defection.

This is where digital forensics comes into play. When a user accesses the internet, copies files to the cloud or a memory stick, sends webmails, burns DVDs or prints documents, he or she leaves a forensic trail for the experienced investigator to follow. Even highly computer literate users often have little idea of the digital traces their actions leave behind. This is especially true with smartphones, tablets and even specialised encryption and deletion tools, which are often used by those attempting to cover their tracks.

If possible, the investigation to identify telltale traces of data exfiltration or a planned defection should start before a suspect is aware he or she is under scrutiny. Take, for example, the case of one individual who used a company mobile phone for communicating about a forthcoming defection. The employer did not want to alert the member of staff by taking the phone for analysis for fear that suspect would then destroy other relevant information. Instead, the investigators analysed the phone's data by retrieving a copy of the phone's synchronisation on to the employee's computer, which could be examined without alerting the individual. The incriminating SMS messages found as a result of this analysis then led to other sources of information, which were preserved before the employee knew he was under suspicion.

In our experience, a business' awareness and a readiness to tackle data theft or staff poaching are directly linked to its experience of such an event. With often potentially serious long-term financial and commercial consequences, the decision-making and management behind this process will be key to limiting the fallout.

Mitigating the risk of becoming a victim of malicious insiders requires an appropriate balance to be struck between deterrence, technology, security, culture and management accountability. However, the implementation of a digital forensic investigation strategy that can withstand external scrutiny will help to reduce the risk of drawn-out and costly litigation.

Julian Parker is a managing director in the London office of Stroz Friedberg